Privacy Policy

1. Who We Are

Kirana Notes is an education and information organisation service based at 62 Jalan Bendahara, 75100 Melaka, Malaysia. We operate as the data controller in respect of personal data collected through our website and in connection with our services.

We are subject to Malaysia's Personal Data Protection Act 2010 (PDPA) and handle all personal data in accordance with its provisions. We do not handle any health or financial records belonging to our clients; all retirement documents remain the property and responsibility of the individual.

2. Personal Data We Collect

We collect the following categories of personal data:

• Contact information: name, email address, and optionally phone number — submitted through our enquiry form or provided during a service engagement.
• Enquiry content: any message or description of your situation submitted through the website contact form.
• Cookie and usage data: cookie consent preferences stored locally in your browser and, where analytics cookies are accepted, aggregated information about website usage such as pages visited and session duration. We do not collect this data if analytics cookies are rejected.
• Programme participation records: for participants in the Bilingual Literacy Programme, first name and contact details for scheduling and programme delivery purposes.

What we do not collect: We do not collect, copy, retain or store the content of retirement documents, EPF statements, pension scheme correspondence, or any personal financial records that may be present during a filing consultation. Those remain entirely in your possession.

3. How and Why We Use Your Data

We process personal data for the following purposes and on the following legal bases under the PDPA:

• Responding to enquiries — to reply to messages sent through our website form. Legal basis: consent (submission of the form).
• Delivering services — to schedule and deliver the filing consultation, programme sessions, or consulting engagement you have engaged us for. Legal basis: contract performance.
• Website analytics — where you have accepted analytics cookies, to understand how our site is used and to improve its content. Legal basis: consent.
• Legal compliance — to comply with any applicable legal obligation. Legal basis: legal obligation.

We do not use personal data for unsolicited marketing communications. If we send you information about other services, we will ask for your consent first.

4. Data Sharing and Third Parties

We do not sell, rent or share your personal data with third parties for their own marketing purposes. We may share data with:

• Service providers acting on our behalf (such as website hosting and email service providers), under data processing agreements that restrict their use of your data.
• Competent authorities where required by law or court order.

Where analytics services are used, data is aggregated and not used to identify individuals. Website analytics data is not combined with your enquiry or programme data.

5. How Long We Keep Your Data

• Enquiry data (name, email, message): retained for 12 months from the date of submission, or until you ask us to delete it, whichever is sooner.
• Service engagement records: retained for 3 years from the date of the engagement for record-keeping and quality assurance purposes.
• Cookie consent data: stored in your browser's local storage. Cleared when you clear your browser data or withdraw consent on our cookie policy page.

6. How We Protect Your Data

We take reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction. These include:

• HTTPS encryption for data transmitted through our website
• Access to personal data limited to staff who need it for service delivery
• Secure handling of any physical documents during consultation sessions
• Regular review of our data handling practices

In the event of a personal data breach that poses a risk to your rights, we will notify the relevant authority and, where required, affected individuals, within the timeframes required under the PDPA.

7. Cookies

Our website uses cookies to store your consent preferences and, where you have accepted them, to collect anonymised analytics data. Essential cookies that keep the site functioning are always active. All other cookies require your consent. You can manage your cookie preferences at any time via our Cookie Policy page. Full details of the cookies we use are provided there.

8. Your Rights Under the PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to your personal data:

• Right of access: to obtain a copy of the personal data we hold about you.
• Right to correct: to request correction of inaccurate or incomplete data.
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to limit processing: in certain circumstances, to request that we restrict how we use your data.
• Right to lodge a complaint: with the Department of Personal Data Protection Malaysia (JPDP) if you believe your rights have been infringed.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

9. Links to Other Websites

Our website may contain links to external websites, including published scheme documents from EPF, KWAP or employer schemes. We are not responsible for the privacy practices of those sites and recommend reviewing their own privacy notices. This policy applies only to data collected by Kirana Notes.

10. Age

Our services are directed at adults managing retirement documentation. We do not knowingly collect personal data from persons under the age of 18. If you believe we have received data from a minor, please contact us at [email protected] and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. Material changes will be communicated by a notice on our homepage for a period of thirty days. Continued use of our website or services after changes have taken effect constitutes acceptance of the revised policy.